User-Defined Alerts: Real-Time Notifications
The user-defined alerts in Coralogix enable you to obtain real-time insights based on the criteria of your own choosing. It is a very simple process that grants users full flexibility, advanced alerting options, and real-time push notifications to your preferred communication channel.
Here’s how it is done.
1) From the main dashboard, open the logs tab:
2) Perform a query to filter the logs that will be returned as part of the alert. You may use a combination of the query input or the filters on the left side panel. For additional information about how to query logs see here:
3) When you have the right log results, click on the “Create Alert” button. The alert configuration window will be open now.
4) In the Details section, you need to fill General alert params: Define Name, Alert description and Alert Severity.
5) In the Query section, you will see the query that you entered in the logs screen. You can click the ‘Edit’ button if you need to change the query.
6) In the Condition section, you set the conditions for triggering the alert – whether you want the alert to trigger immediately or you want to define a rule for ‘More/Less’ occurrences within a specified time window or using our new ‘more than usual’ anomaly detecting option.
Immediately: An immediate alert will notify immediately and will be silent for one minute. Hit count will present 1 in immediate alert as we notify on the first log that matches.
More/Less Than: A ‘More’/’Less’ alert will trigger when the count of the entries that matched the alert definition will be more/less than the chosen threshold. Hit count will present the actual number of entries that matched within the selected time window.
More Than Usual – Dynamic Alerts: Setting appropriate thresholds for each metric can be daunting especially with highly variable data which tend to generate many false positive alerts. Coralogix Dynamic Alerts enable you to detect abnormal
automatically – without having to set fixed threshold values.
Notify When Resolved: You can also add an automatic ‘Resolve’ message to your ‘More/Less Than’ alerts. Just mark the ‘Notify on resolved’ checkbox under the ‘More’/’Less’ control and you’ll get an automatic update once an alert is not occurring anymore (works with all notification methods).
Group By: You can enhance your ‘More’ alerts by adding the ‘Group by’ option: values under the ‘Group By’ field are aggregated into a histogram. An alert will trigger whenever any of the aggregated values appear more than the threshold within the specified timeframe. Of course, only logs that include the ‘Group By’ field will be included in the count. Up to 5 unique values of the selected field and their count will show up in the event details screen, along with the threshold value. Of course, all regular filters, such as application, subsystem, severity, etc.. may be applied to the alert as well. This is how it will look like in Coralogix:
7) In the Recipients section, you choose who do you want to be notified, it could be an e-mail address, Slack room or custom webhook or all of them.
8) In the Schedule section, it could be always active or limit triggering to certain days and hours
9) In the Notification Content section, you can choose what portion of the log you want to see when notified, ‘Full Log Text’ to be shown with the entire log or ‘Specific JSON Key’ to be shown with a specific key and its value (you can add multiple keys).
10) In the Verify Alert section, you can check how many times the alert would match the criteria in the last 24 hours.
11) In the History section, you can see which user performed a change in the alert and when.
12) The final step is to click on the ‘Create alert’ button on the upper-right side of the screen. You’re all set! Now you can view your alerts.
View Alerts
The ‘Alert logs’ view within the ‘Insights’ tab shows the logs which triggered the alert:
“Logs” view within ‘Insights’ tab shows all the logs prior to and after the alert was triggered, with the triggered alert itself highlighted:
Notes:
You can create a new alert by entering the alerts page and pressing on the “new alert” button.
You can see in the alerts menu who is the user that created the alert.
You can see in the alert the history of edits that were made.
Snoozing alerts
Snooze alerts was made for those cases where the alert was triggered and handled and there’s no need for further notifications while you are focused in resolving the issue
Snooze or disable snooze
Go to your dashboard and click on the snooze button next to an alert
Snoozed alert tooltip:
Hover your mouse over the snooze button to see who snoozed the alert and when snooze period ends
